A slightly rhetorical question I guess, but I have been trying to get wsHttpBinding to work for my application, and although it does work perfectly if I am able to physically import the required keys onto a client machine (which is clearly not feasible for a publicly available application), trying to deploy those certificates programmatically is proving extremely difficult. Not only that, but it has a weak point in that the private key password must be in the certificate installation application anyway - theoretically rendering the secure WCF link useless anyway.
I am now at the point where I am considering simply using basicHttpBinding, but encrypting the limited amount of data I am sending using the server's public key (file based using CryptoSys PKI). Does basicHttpBinding leave me open to any other kind of risk? I only use the server connectivity to service activation requests - after that, no other contact is necessary.
I've not noticed any other applications installing certificates onto my machine in order to service activation requests - e.g. Kaspersky must securely contact it's activation server - but there are no obvious certificates in the store.